========================================================================
CVE-2026-110677                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110677

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.28 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array
collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array
collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are
collected into a new array. An extra reference is never released, so
the array and every value in it outlive the decoded structure. The
array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large
value exhausts process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.